feat: bridge canonical pairing authority

[replghost]

Summary

• expose the canonical paired-session blob from the signing host and activate it in the pairing host
• reconcile the pairing runtime when the encrypted auth-session core-storage slot changes, including clear and disconnect behavior
• keep session decoding strict and make core-storage auth keys stable across host implementations

Why

Epoca has one browser process but two RFC-0022 host roles: the local signing host owns Mobile SSO, while each product tab uses a pairing host. This bridge lets the product runtime use the exact authenticated authority established by the signing host instead of inventing a browser-only SSO protocol or silently falling back to the local wallet.

Verification

• cargo test -p truapi-server -p truapi-platform (439 passed)
• cargo fmt --all -- --check

Dependency

Stacked on #329 so the UserAgentKit vendor can retain the Product SDK follow-alias fix already pinned by Epoca.

[replghost]

Superseded by the final reviewed head of #329 (450c0a8a3878d75c386e063151af4676d0c8becc), which contains this canonical pairing-authority bridge plus the follow-alias and session/AutoSigning isolation fixes. UserAgentKit and Epoca now pin that single commit.